Windows 10 Insider Preview 17063 announced on the 20th December 2017 has added a new restriction that unfortunately has caused the Macrium Reflect Changed Block Tracker (CBT) driver (MrCbt.sys) not to load at startup.
So what's happened?
MrCbt.sys is a Windows kernel driver that follows a similar architecture to Microsoft's own Volume Shadow copy Service (VSS) driver VolSnap.sys. The style of this driver is known as 'Legacy' and there are several MS drivers of this type in the kernel stack, in all versions of Windows.
Windows 10 version 1607, introduced a new registry entry to block legacy drivers - IoBlockLegacyFsFilters, and this registry entry had to be explicitly set to exclude legacy drivers from loading. However, the default value for this new registry entry has been changed from '0' (Not blocked) to '1' (blocked) in the Insider Preview 17063 build of Windows 10. This means that that no 'Legacy' kernel drivers, except for Microsoft's own legacy drivers, are loaded at boot time. Unfortunately this causes a fatal error when Windows starts if any legacy driver is designated as a boot start upper filter driver.
More information on IoBlockLegacyFsFilters can be found here: https://docs.microsoft.com/en-gb/windows-hardware/drivers/ifs/blocking-file-system-filter-drivers
What can be done?
Assuming that this default registry change makes it to production versions of Windows then the solution is to re-write our CBT driver to prevent it being classified as legacy. In the short term creating IoBlockLegacyFsFilters with a value of '0' will allow MrCbt.sys to load and operate without problems.
|Key:||HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\I/O System|